This repo follows GitHub Flow: change on a branch, open a pull request, merge into the default branch. Direct pushes, force-pushes, and branch deletion on master are blocked.

Please use GitHub private vulnerability reporting rather than opening a public issue.

Include:

• which script or path is affected
• what an attacker would need (local shell, sudo, a crafted filename, etc.)
• a minimal reproduction if you have one

I will acknowledge reports and credit you if you want that.